How do I suppress possible typo in web.conf for ESS on 4.2

[hazekamp]

When I start my Splunk server I see

Possible typo in stanza [settings] in $SPLUNK_HOME/etc/apps/SplunkEnterpriseSecuritySuite/default/web.conf, line: 2: disabled_decomposers = addtermgt, addtermlt

Is this a configuration error? How can I suppress this message?

[hazekamp · Accepted solution]

This is not a configuration error, rather a setting that has been deprecated in 4.2. In 4.1.5+ one was able to selectively disable decomposers; however in 4.2 decomposition is selectively enabled via the "enable_decomposers" setting.

This message can and should be suppressed (and will be for 4.2.x only compatible builds of ESS):

To suppress, comment (prepend a '#' to) the following line in $SPLUNK_HOME/etc/apps/SplunkEnterpriseSecuritySuite/default/web.conf

Was:

disabled_decomposers = addtermgt, addtermlt

Should be:

#disabled_decomposers = addtermgt, addtermlt

Typically we do not advocate changing "default" configuration files; however, since this is a deprecated setting it cannot be overridden as it should not exist in the first place.